CVE-2020-7705

Katalog CVE

CVSS 8.1 · High EPSS 1,2%

Kerentanan Improper Restriction of Rendered UI Layers or Frames pada mintegraladsdk. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.

Rincian

Terbit di NVD

24 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1021: Improper Restriction of Rendered UI Layers or Frames

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/ advisory pihak ketiga
• https://snyk.io/research/sour-mint-malicious-sdk/ advisory pihak ketiga
• https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852 advisory pihak ketiga